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We present a breeding protocol that distills pure copies of any stabilizer state from noisy copies 
and a pool of predistilled pure copies of the same state, by means of local Clifford operations, Pauli 
measurements and classical communication. 
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I. INTRODUCTION 

In recent literature, much attention has been paid to 
the distillation of multipartite entanglement. Distillation 
is the recovery of entanglement that has been disrupted 
by the environment, by means of local operations and 
classical communication. Like quantum error correction 
codes, entanglement distillation protocols are indispens- 
able procedures towards the realization of many quantum 
communication and quantum cryptography applications, 
requiring pure multipartite states that are shared by re- 
mote parties 0, H |f 0, & E S . 

Many generalizations to a multipartite setting have 
been found, mainly based on protocols for bipartite 
entanglement distillation 0, They can be cat- 

egorized according to asymptotic (hashing/breeding) 

versus recurrence-like schemes 
to whether 

they take noise in the recovering operations into account 
[l3L llil HH fl8l l24j or to the kind of quantum states they 
are designed for. The cited references are only suited for 
Calderbank-Shor-Steane (CSS) states or states that are 
locally equivalent [32j to CSS states (e.g. two-colorable 
graph states, GHZ states, cluster states), exce pt R ef. |23| 
(for the W state) and the recent papers fiefs. jlal2ll l24| 
(for arbitrary stabilizer states). 

In this paper, we present a generalization of the breed- 
ing protocol for arbitrary stabilizer states, which is to 
a large extent similar to our previous paper Ref. [13 for 
CSS states. Again, we define a class of local Clifford oper- 
ations that distribute the information content of multiple 
noisy copies of a stabilizer state without destroying the 
tensor product, i.e. they transform multiple copies of a 
pure stabilizer state into multiple copies of the same sta- 
bilizer state. Breeding, contrary to hashing starts 
from k noisy copies of an n-qubit stabilizer state and 
a pool of (1 — "f)k predistilled pure copies of the same 
state, where k is considered large (asymptotic protocol). 
After the local Clifford operations, we locally measure 
the (1 — j)k initially pure copies, yielding information on 
the global state. This information extraction reduces the 
entropy, resulting in k remaining copies that approach 
purity (zero entropy) and are suited for the application 



in mind. The measured copies are afterwards separable 
and can be discarded. The yield of the protocol is the 
net output of pure copies that is distilled for every noisy 
copy, and equals 

#(pure output copies) -# (pure input copies) 
#(noisy input copies) 

fe-(l-7)fc 

= k = 7- 

Our result is very much inspired by the work of Clancy, 
Knill and Vasconcelos [2l| , in which (nonasymptotically) 
CSS-H states are purified by any stabilizer code, CSS 
states by a CSS code and arbitrary stabilizer states by a 
CSS-H code. Contrary to Ref. |2l|, we use a permutation- 
based approach instead of a code-based approach pjj . 
But very similar cases can be distinguished. For CSS 
states, we use local Clifford operations that are built ex- 
clusively of Controlled-NOT (CNOT ) op erations, which 
correspond to CSS codes. In Ref. 12] however, more 
general local Clifford operations are possible for specific 
CSS states, but CNOTs do always satisfy. Arbitrary lo- 
cal Clifford operations can be used for states that satisfy 
certain orthogonality conditions ^ can be verified 

that these states are CSS-H states. And now we will 
show that local Clifford operations, built of CNOTs and 
represented by an orthogonal matrix, corresponding to 
CSS-H codes, are suited for the distillation of arbitrary 
stabilizer states. 

This paper is organized as follows. In Sec. Ill Al we 
give a brief overview of the binary linear algebra frame- 
work in which we describe the stabilizer formalism. In 
the past, this "binary picture" has been prov ed useful in 
the conte xt of distillation protocols [3 |H m El- In 
Sec. Ill Bl we summarize some properties of the strongly 
typical set that we will need to calculate 7. For the sake 
of readability, we prefer to make proofs not as rigorous as 
in Ref. [Tj|> since they are highly similar. In Sec. IIIII we 
explain the breeding protocol and calculate 7. We illus- 
trate this with a typical example in Sec. lIVI We conclude 
in Sec. E| 



II. PRELIMINARIES 



A. The stabilizer formalism in the binary picture 
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In this section, we give a brief overview of the binary 
matrix description of Pauli operations, stabilizer states 



2 



and Clifford operations. For a more elaborate discussion, 
we refer to Refs. |0,|2^. In the following, all addition 
and multiplication of binary objects is performed modulo 
2. 



Pauli operations 



We use the following notation for Pauli matrices. 
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011 


= a v = 


i 






Let D.tiigZ? and a = 



, then we denote 



0~a — 0~v\ w. ® • • ■ ® 0~v n w n • 

The Pauli group on n qubits is defined to contain all 
tensor products a a of Pauli matrices with an additional 
complex phase factor in {1, i, —1, — i}. In this paper, we 
only consider Hcrmitian Pauli operations, so we may ex- 
clude imaginary phase factors. It can be verified that 
Pauli operations satisfy the following commutation rela- 
tion: 



a 0& = (-1)° 060a, where P = 



I n 

In 



(1) 



2. Stabilizer states 

A stabilizer state on n qubits is the simultaneous eigen- 
vector, with eigenvalues 1, of n commuting Hermitian 
Pauli operations (— l) bi <r Si , where s, G Z| n are linearly 
independent and 6; £ Z2, for i — 1, . . . ,n. These Pauli 
operations generate an Abelian subgroup of the Pauli 
group on n qubits, called the stabilizer S. We will assem- 
ble the vectors Sj as the columns of a matrix S G Zj™ Xn 
and the bits bi in a vector & e Zj. With (JTJ, commu- 
tativity of the stabilizer is reflected by S 7 PS = 0. The 
representation of S by 5* and b is not unique, as every 
other generating set of S yields an equivalent description. 
In the binary picture, a change from one generating set 
to another is represented by an invertible linear transfor- 
mation R G ZJ*™ acting on the right on S and acting 
appropriately on b. We have 



S' = SR 
b' = R T b 



(2) 



where d G ZJ? is a function of S and R but not of b [28| . 
In the context of distillation protocols, d can always be 
made zero |T^ . 



Each S defines a total of 2" orthogonal stabilizer states, 
one for each i £ ZJ. As a consequence, all stabilizer 
states defined by S constitute a basis for TC® n , where H 
is the Hilbert space of one qubit. In the following, we 
will refer to this basis as the 5*-basis. 

Let |^i) and j^} be two stabilizer states represented 



by Si = 



Si( z ) 

Sl(x) 



, bi and S2 — 



2(g) 
2(x) 



, 62 respectively. 



Then \tpi) £g) ji/^} is a stabilizer state represented by 



h 
b 2 



l(z) 


- 





S 2 (z) 


l(x) 








S2(x) - 



(3) 



If the phase factor vector b of a stabilizer state \4>) rep- 
S 1 

is unknown, information on b by 



resented by S = 



S x 



local measurements can be extracted as follows. From the 
definition of it follows that a Sv \ip) = {-l) vTb+d \i/j) 
for every n £ Zj, where d G TL 2 is a function of S and v 
|28j. Consequently, we can find the inner product v T b by 
determining the eigenvalue of for as v - We determine 
the eigenvalue for <j g by locally measuring its nontriv- 



ial factors a a 



on qubits i = 1, . . . ,n, and taking the 



product of the outcomes. It follows that the eigenvalue 
for a g and 0/j can be determined both if and only if the 
factors ffi9 „ +i and 0^ i h„ +i commute, for all i. In the 



binary picture: let M be a partition of {1, 



1} into 



three disjunct subsets M z , M x and M y , and perform a 
02, a x or <j y measurement on qubits i G M z , M x or M y 
respectively. Note that there exists 3 n such partitions. 
Then from the outcomes of these measurements we can 
calculate v T b for all v that satisfy 

supp (S z v) \supp (S x v) c M s , 

supp (S x v) \supp (Sgv) C M x , (4) 

supp (S z v) n supp (S x v) c My, 

where the support of a vector v £ is defined as 

supp (v) = {i G {1, . . . ,n} I Vi = 1}. 

All v satisfying Q constitute a subspace V(A4) of Zj. 
We denote dim[V(A^)] by n(M). 

3. Clifford operations 

A Clifford operation Q, by definition, maps the Pauli 
group to itself under conjugation: 

Q ffo Qt = (-l) 5 CTb . 

In the binary picture, a Clifford operation is represented 
by a matrix C G Zj nx2n and a vector /i G Z| n , where C 
is symplectic or C T PC = P 28]. The image of a Pauli 
operation a a under the action of a Clifford operation is 
then given by (— l) £ 0'Ca, where e is function of C, h and 
a. 



3 



If a stabilizer state represented by S and b, is 
operated on by a Clifford operation Q, represented by C 
and h, Q\il>) is a new stabilizer state whose stabilizer is 
given by QSQ^ . As a result, this stabilizer is represented 
by 



S' 
b' 



cs 

b + f 



(5) 



where / is independent of b and can always be made 
zero, by performing an extra Pauli operation a g before 
the Clifford operation, where S T Pg = f jl^ . 

Let Qi and Q 2 be two Clifford operations represented 



by 



and 



blocks are in Z" xn . 
ation represented by 



A 2 B 2 
C 2 D 2 
Then Qx 



respectively, where all 
5 Q 2 is a Clifford oper- 



Ax Bx 

A 2 B 2 

Cx Dx 

C 2 D 2 



(6) 



The breeding protocol that will be introduced in 
Sec. IIIII considers k stabilizer states on n qubits that are 
shared by n remote parties, each holding corresponding 
qubits of all k states. Each stabilizer state is represented 
by the same S. According to © , the overall state is then 
represented by 



S z 
S x 



, b' = 



bx 



Since it is more convenient to arrange all qubits per party, 
we rewrite the stabilizer matrix by permuting rows and 
columns as follows: 



S z 



= S®h, b = 



bx 



b n 



(7) 



where the entries of b' are permuted appropriately into 
b £ 1 2 k . All parties perform the same local Clifford oper- 
ation, built only of CNOTs. It is shown in Ref. |2g that 
a Clifford operation, composed of CNOTs, is represented 
by 



C = 



A 

A- T 



where A is invertible. With iJB}, the overall Clifford op- 
eration is then represented by 



I n ® A 

/„ 





5 A' 



(8) 



Furthermore, we will demand that A £ l! 2 :y ' k is orthog- 
onal, i.e. A~ T — A. In that case, the representation of 



the overall state after the local Clifford operation can be 
transformed back into the original form of J7J by multi- 
plication with R= I n ® A T on the right, since 

(hn ®A){S® I- k ){I n ®A T ) = S® I- k . 

Using J2Jl and |J5J, b is then transformed as follows: 

b {I n ® A)b. (9) 

B. Strongly typical set 

In this section, we introduce the information- 
theoretical notion of a strongly typical set. For proofs, 
we refer to Ref. 01 • Good introductor y m aterial on in- 
formation theory can be found in Ref. \M- We use the 
compact notation x ~ y for x = y ± e, where e — ► for 
k co. 

Let X = (Xx, ■ ■ ■ , Xk) be a sequence of indepen- 
dent and identically distributed discrete random vari- 
ables, each having event set f2 with probability function 
p : Q, — > [0, 1] : a — > p(a). The strongly typical set T^ 1 is 
defined as the set of sequences x — (xx, ■ ■ ■ , x k ) & Q k for 
which the sample frequencies f a (x) — \{xi \ Xi — a\\jk 
are close to the true values p(a), or: 

xeT e W \f a ( x )-p(a)\ <e, VaeO. 

It can be verified that p(T^ ) > 1 — S, where 6 = 

0(k~ 1 e~ 2 ). Therefore, p(Te ) ~ 1 for k — > co. In words, 
a random sequence x will almost certainly be contained 
in the strongly typical set. 

Let f2 be partitioned into subsets fl,- (j = 1, . . . , t). We 
define the function 

y(x) = (flj 1 , ...,Qj h ), where Xi £ Qj i , for i = 1, . . . , k. 

In Sec. 1111 CI we will encounter the following problem. 
Given some u £ T^ k \ calculate the number \M U \ of se- 
quences v £ that satisfy y(v) — y(u), or 

K = {v£ T e ( fe ) | y(v) = y(u)}. 
It can be verified that 
log 2 \M U \ 



k 



H(X) - HOT), 



where 



H(X) = -Y, p(a)log 2 p(a) 
and H(Y) = - E K%) log 2 p(%) 

are the entropies of X and y{X) respectively. 
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III. BREEDING 



k = (2 — -f)k and b from b as follows: 



In this section, we show how the protocol works and 
calculate the yield. The standard information-theoretical 
interpretation of hashing/breeding protocols is as follows. 
We have k copies of a mixed stabilizer state p, that we 
wish to purify. The global state of the copies can be 
regarded as a classical ensemble of pure states or, equiv- 
alently, as an unknown pure state of which we know the 
a-priori probabilities. With vanishing error probability, 
this unknown state can then be assumed to be contained 
in the strongly typical set . The protocol consists of 
local Clifford operations, followed by local measurements. 
These measurements yield information on the unknown 
state, eliminating all elements T( fc ) that do not match the 
outcomes. The protocol ends when all elements but one 
are eliminated from T^ k ' and we are left with a known 
pure state. 

This section is organized as follows. In Sec. lIII Al we go 
into more detail on the information-theoretical interpre- 
tation as explained above. 



In Sec. IIII Bl we show which 
measurements maximize the amount of extracted infor- 
mation or, equivalently, the probability that an element 
of 7~( fc ) is eliminated. Finally, in Sec. 1111 CI we calcu- 
late the minimal number of measurements necessary to 
reduce to a singleton with probability approaching 
unity. The remaining element is the formerly unknown 
pure state. 



A. Protocol 

As noted in Sec. Ill Al all 2™ stabilizer states repre- 
sented by the same S 6 Zj™*™ constitute a basis for 
%® n , which we call the S'-basis. The protocol starts with 
k identical copies of a mixed state p that is diagonal in 
this basis and (1 — j)k copies of the pure stabilizer state 
represented by S and 6 = 0. The copies of p could for 
instance result from distributing k pure copies via im- 
perfect quantum channels. If p is not diagonal in the 
S'-basis, it can always be made that way by performing 
a local POVM measurement fijl. We have 



for i = l. 



X>(6)hW 6 | 



where \ipb) stands for the stabilizer state represented by S 
and b. The mixed state p can be regarded as a statistical 
ensemble of pure states \ipb) with probabilities p{b). Con- 
sequently, p® k is an ensemble of pure states represented 
by S ® Ik and 6, with probabilities 



P(b)=p(b') = l[p(k). 



Again, the entries of b correspond to the nk phase factors 
ordered per party instead of per copy like b' . We define 



and we have that p® k £g> (|V , o)(V , o|) is represented 

b y Q. 

The ensemble can be interpreted as an unknown pure 
state. The probability that this state is represented by 
b is then equal to p(b). Let this unknown pure state be 
represented by u. With probability approaching unity, 
u is contained in the set T^ k \ defined as in Sec. Ill Bl 
Here, fl is the set of all 6 e ZJ. So with negligible error 
probability, we may assume that u G T^. 

The protocol consists of the following steps: 

1. Each party applies local Clifford operations (JSJ) 
with orthogonal A, that, with 10, result in the 
transformation ui — > Aui, for i = 1, . . . , n. 

2. The resulting last (1 — j)k copies (which were the 
initial pure states) are measured locally, yielding 
information on u. Afterwards, these copies are in a 
separable state and can be discarded. 

After each measurement, we eliminate every b G T' fe ' 
that is inconsistent with the measurement outcome. The 
protocol ends when all b ^ u are eliminated from T^ fc ' 
and only u is left. 



B. Maximal information extraction 

The local Clifford operations (JSJ) transform each 6; to 
Abi, for i = 1, . . . , n. As the last (1 — ^)k entries of 
bi are zero, and the last (1 — "f)k copies are the ones 
measured, the only relevant part of A is the lower left 
(1 — 7) k x k part. We define Q as the transpose of this 
part. We show in Appendix^ for arbitrary full rank Q, 
how to construct an orthogonal matrix A with lower left 
(1 — 7)/c x k part Q' T , where Q' is either equal to Q or 
equivalent to Q for the protocol. 

We calculate the probability that some b ^ u is not 
eliminated after the local measurement of one of the (1 — 
j)k ancillary n-qubit states (take the ith). Let Ai be the 
partition according to which this state is measured and 
q the ith column of Q . If we organize b in the following 
matrix: 



B=[h ■■■ b k ] 



then, by the local Clifford operations, bk+i is transformed 
into Bq. Defining U in the same way, u^+i is trans- 
formed into Uq. We know from Sec. Ill Al that the mea- 
surement reveals V T Uk+i = V T Uq, where col(V), the 



column space of V G Z 



nxn(Ai) 



equals V{M). The in- 



formation contained by V T Uq is maximal when q is uni- 
formly distributed over Z*. Indeed, as V T Uq is a linear 
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function of q, then V T Uq will be distributed uniformly 
too (over the range of V T U). 

If and only if V T (B + U)q = 0, then b is not eliminated 
from 7~( fc ' by the measurement. Indeed, in that case b 
would have the same measurement outcome V T Bq as u. 
Let A6 = b + u and d(M, Ab) the rank of V T AB, which 
is at most n(A4). Then the probability of V T ABq = is 
equal to 2 -< H- A/1,Ai ') ) as this is the inverse of the number 
of elements in the range of V T AB. The same reasoning 
can be applied to all measurements. Consequently, the 
probability that some b will not be eliminated after all 
measurements is equal to 



-k£ m(M)d(M,Ab) 



(10) 



where km{AA) is the number of measurements corre- 
sponding to partition M. Note that Y^m to (-M) = 1—7. 



C. Minimal number of measurements 

So far we have given an information-theoretical inter- 
pretation of the protocol: we start with an unknown pure 
state (represented by u), which is almost certainly con- 
tained in 7~( fe '. Consecutive measurements rule out all 
inconsistent b G T^ k \ The probability that a particular 
b ^ u survives this process equals (fTTTfl . Consequently, 
the probability that any b 7^ u survives the process is 
equal to 



„ -kY,m(M)f{M) 



(ii) 



fro 



where the sum runs over all functions / : f(M.) G 
{0, 1, . . . , n(M)} that are not identical to zero. Nf 

is the number of b G for which d(M , Ab) — 

Aim[AB T V{M)\ = f(M). Let Nj = 2 ka *f . Then JTTJ 
vanishes if and only if the following inequalities hold: 

m(M)f{M) > a}, for all / ^ 0. (12) 

M 

Let Nf — 2 ka f be the number of b G for which 

d(M,Ab) < f(M). Evidently, 



N f = J2 N *f» 

f'<f 



(13) 



where f < f stands for: f'(M) < f(M) for all M. The 
inequalities 

J2 m (M)f(M) > a f , for all / 0, (14) 

M 

are equivalent to i|12[) . Indeed, it follows from 113|) 
that af w a/' « for some f < f |33l | . 

Since 5^m(A4)/'(A^) > a% « af ks af implies 
M 



Y^Tn(M)f{M) > af, a solution to (jT4*|) is also a solu- 



M 



tion to (|12[1 and vice versa. 

This leaves us to calculate Nf. Let Qf{M) be a n(M) — 
f(M) dimensional subspace of V(M). For a space Q, we 
define 

C{Q) = {Ab G Z 2 lfc I G T AB = 0, where col(G) = G}. 

It follows that d(M,Ab) < f(M) for all Ab G £[5/(.A/f)]. 
Wc then have 



Nf 



\{Jc(j25f(M))nT^\ 



M 



where the union runs through all functions Qf : A4 — > 
{7/(A4), where every Gf(Ai) is a subspace of V(.M) with 
dimension n(Ai) — f(M). It follows that 

N f =rm^\£ (^GfiM^j nT«|, 

where 1 < r < the total number of functions Qf, which 
is independent of k. Therefore, 



af ~ log 2 (max \ C 

<3f 



\G S {M) )nT^\)/k. 



M 



We now calculate log 2 \C(G) n T^\/k. Note that 
Ab G C{G) if and only if G T Ah = 0, for i = 1, . . . , k. 
The cosets Qj (j = 1, of the space — {v G 

7LVj\G T v — 0} constitute a partition of Z 2 . Note that 
t = 2 dlm ( e ' . We want to know the logarithm, divided by 
k, of the number of b G T^> for which bi is in the same 
coset as Ui, for all i = 1, . . . , k. We know from Sec. Ill BI 
that this is approximately 



H-C(G) where H 



E P{b)\og 2 p(b) 



and C(G) = - J2 p(%)log 2 p(%). 



Let 



It follows that 



a s *>H-Hf. 



(15) 



The yield 7 is maximized by minimizing the total num- 
ber of measurements. With (|14J) and Ijl5|l . this results in 
the following linear programming (LP) problem: 

minimize m {M) 
M 

subject to J2 m (M)f{M) > H - H f , for all / ^ 0. 
.M 
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IV. ILLUSTRATION WITH A 
THREE-COLORABLE GRAPH STATE 

We illustrate our protocol with an example. Any sta- 
bilizer state is locally equivalent to a graph state, i.e. any 
stabilizer state can be reversibly transformed into a graph 
state by means of one-qubit Clifford operations [3G, |31| • 
In order not to be covered by our previous result [l2j | , the 
given example should be a state that is not equivalent to 
a CSS state or a two-colorable graph state. The 5-qubit 
ring state, which is an example of a three-colorable graph 
state is such a state. We calculate the yield for the 
following mixture: 

p = F\i )Q ){M + ^S[ E i^x^i. 

bez|\{o} 

where !?/>{,) is binary represented by S and 6, and 



<= dim(<?) smaller. So we have to choose Of (Mi) for 
different i as overlapping as possible to find the highest 
lower bounds in the LP problem formulation. For this 
example, there is a one-to-one relationship between Hf 
and dim(C?): 



dim(£) 


H f [dim{Q)] 








1 


l 0g2 [F + |f(l -F)] 
-[if(l-F)]log 2 [if(l-F)] 


2 


-[F + ^(l-F)]log 2 [F+^(l-F)} 
-3[£(l-F)]log 2 [A(l_F)] 


3 


_[j? + A(i_ F )]io g2 [ F + ^(i_ F )] 
-7[£(l-F)]log a [£(l-F)] 


4 


-[F + i(l-F)]log 2 [F + i(l-F)] 
-15[&(l-F)]log 2 [&(l-F)] 


5 


-Flog 2 F-31^f log 2 (^f)=H 



s = 



, with 8 = 



110 

1 1 

1 1 
110 
110 



It can then be verified that the yield 7 equals 1 — 
Ei=i m(-Mi) — 1 — 5m where m is the solution to the 
following LP problem: 



minimize 



We will only consider the following partitions: 



Mi : 


M z 


= {3,4,5}, M x 


= {1,2}, 


My = 0; 


8m 


> 


H 


M 2 ■ 


M z 


= {1,4,5}, M x 


= {2,3}, 


M y = 0; 


6m 


> 


H 


M 3 : 


M z 


= {1,2,5}, M x 


= {3,4}, 


My = 0; 


4m 


> 


H 


Mi : 


M z 


= {1,2,3}, M x 


= {4,5}, 


My = 0; 


2m 


> 


H 


M 5 : 


M z 


= {2,3,4}, M x 


= {1,5}, 


My = 0. 









By restricting to these partitions, we risk finding a sub- 
optimal solution. However, we will show below that the 
solution found is in fact optimal. It can be verified that 
these partitions satisfy n(Mi) — 2, and for no other par- 
tition n(M) > 2. For symmetry reasons, we may assume 
that the optimal m(Mi) will be equal for all Mi- We 
have 



subject to 10m > H - H f (0) = H 

Hf(l) 

#/(3) 
Hf{4) 

Numerical calculation shows that the first inequality is 
the most binding. Therefore, 
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1 



H 
~2 ' 



V(Mi) = col(V) where V 



1 

1 









and f(Mi) can be either 0, 1 or 2: 

-> if f(Mi) = then g f {Mi) = V(Mi), 

-» if f{Mi) = 1 then G f (Mi) = col (e x ) or col (e 2 ), 

-» if f(Mt) = 2 then Q f (Mi) = {0}, 

where G Z 2 is a vector with all zeros except on position 
i. Analogous derivations hold for the other Mi. For 
this highly symmetric example, we can follow the next 
intuitive train of thoughts: H — Hf larger <^ Hf smaller 
<= C(Q) smaller [where Q — J2i=i^f(Mi)] t smaller 



which corresponds to our intuition that every measure- 
ment yields n(Mi) — 2 bits of information. However, 
this will not be true for a less symmetric mixed state p. 
Note that this solution is optimal. Indeed, we cannot 
gain more than 2 bits per measurement, as n(M) < 2 for 
all M. We have plotted 7 as a function of F in Fig.^ 



V. CONCLUSION 

We have presented a breeding protocol that works for 
any multipartite stabilizer state. Starting with k noisy 
copies of a stabilizer state and a pool of (1 — 7)^ predis- 
tilled pure copies of the same state, the protocol consists 
of local Clifford operations on noisy and pure copies, fol- 
lowed by local Pauli measurements on the initially pure 
copies to extract information on the global state. The 
yield 7 is calculated as the solution of a linear program- 
ming problem. We have illustrated this with a typical 
example. 
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FIG. 1: the yield 7 of the protocol for the state p 
F\tp )(ipo\ + (1 -F)/31(l - |^o)(V>o|) as a function of F. 



APPENDIX A: CONSTRUCTION OF 
ORTHOGONAL A 

Before we show how A is constructed, we prove the 
following theorems. 

Theorem 1 Any symmetric matrix W £E x ™ of rank 
r can be factorized as follows: 

W = RDR T , 

where R is invertible and 



(i)D = 



(li) D 



r/2 







1 

1 



if W has zero diagonal, 



if W has nonzero diagonal. 



Proof: We prove that if the theorem is true for all 
n < N, it also holds for n = N + 1. Note that the 
theorem is trivial for zero matrices, as = R0R T , and 
matrices of zero dimension. 

(i) Without loss of generality, we may consider 
(nonzero) W 6 ^( Ar+1 ) x ( JV + 1 ' f the following form: 



W 



a 



1 

1 b T 
a b W 2 



where a, b, W 2 have appropriate dimensions and W2 
has zero diagonal. Indeed, note that identical per- 
mutations of rows and columns of W are for free, 
as they can be absorbed into R as follows: 

PWP T = RDR T =>• W = (P T R)D(P T R) T . 



Since W% + ab T + ba T has zero diagonal and is a 
(N — 1) x (N — 1) matrix, we can write: 

W 2 + ab T + ba T = R 2 D 2 R%. 

It follows that W = RDR T = 



1 













1 







1 





b T ' 





1 







1 













1 




b 


a 


R2 










D 2 










R 2 _ 



By construction, R is invertible because R 2 is. 

(ii) Again, without loss of generality, we may consider 
W of the form: 



W 



1 a T 

a W 2 



We can write: 

W 2 + aa T = R 2 D 2 R\", 
where D 2 is either (i) or (ii). It follows that 

W = RDR T 



1 




1 




"l a T ~ 


a R 2 




D 2 




Rl 



If D 2 is of the form (i), it can be brought to (ii), 
by using the identity 



1 
1 
1 



vv 



with V 



1 1 1 
1 1 
1 1 



This ends the proof. 



□ 



Corollary 1 // and only if a given symmetric matrix 
W G Zj*" is not both full rank and zero-diagonal, we 
can find square M such that W — M T M . 

Proof: Using Theorem ^ we have W = RDR T . If 
D is of the form (ii), we take M equal to R T with the 
rightmost n — r columns set to zero. If D is of the form 
(i) and not full rank, we can find U such that D = U T U, 
by using the identity 



1 

1 




V T V, 



with V = 



1 
1 1 
1 



Then take M equal to UR T with the rightmost n — r 
columns set to zero. 

Finally, we show that if W is full rank and zero- 
diagonal, there is no M satisfying M T M — W. An 
equivalent statement is that there exists no square M 

1 



such that M T M = D = I® 



1 



As x T Dx = for all 



x, M T M = D implies that y T y — for all y — Mx. Con- 
sequently, M cannot be full rank. But then M T M = D 
cannot be true, as D is full rank. This ends the proof. □ 
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Theorem 2 A matrix W 6 xr can be extended to an 



orthogonal matrix A £ ZJ' 



&?/ adding columns, if and 



• e ^ col (W^), where e £ ZJ is £/ie all-ones vector. 



Proof: Define a full rank matrix F e Z. 



n X (n — r) 



such 



that W^ T F = 0. By Theorem □ we can find R and L> 
such that Y T Y — RDR T . For now, we assume that Y T Y 
is full rank. As e ^ col(W), we know that D = J n _ r . 
Otherwise Y T Y has a zero diagonal, or i/??/, = for all 
columns yi of Y. Equivalently, we have yj e = for all 
i, or Y T e = 0, which contradicts e ^ col (IF). Let Z = 



YR- 



then W Z is orthogonal. Indeed, Z T W = 

R- X Y T W = and Z T Z = R~ l Y T YR~ T = D = I. 

This leaves us to proof that Y T Y is full rank. If not, 
then there exists some x ^ that satisfies Y T Yx = 0. 
By the definition of Y, it follows that Yx <E col (W) or 
Yx = Wz for some z ^ 0. But then W T Wz = W T Yx = 
0, which contradicts W T W = /. This ends the proof. □ 

We now show, for a given full rank k x (1 — j)k matrix 
Q, how to construct an orthogonal k x k matrix A with 
lower left part equal to Q' 7 ', where Q' is either equal to Q 
or equivalent to Q for the protocol. This is the problem 
adressed in Sec. IIII Bl We perform the following steps: 

1. find square matrix M such that M T M = I + Q T Q; 



2. create orthogonal A T from W — 
columns. 



M 



by adding 



By Corollary^ step 1 is possible provided that I + Q T Q 
is not both full rank and zero diagonal. In that case, this 
can be solved by adding just one column to Q, as the 
resulting matrix Q' then has an odd number of columns. 
Consequently, we have one measurement more, but as 



k is large, this will not influence the yield. By The- 
orem Step 2 is possible provided that e col(W). 
Let e € col(W). Then there exists some x ^ that 
satisfies Qx = e and Mx = e. Without loss of gen- 
erality, we may assume that xi = 1. If we add any 
column (take the second) of Q to the first, yielding Q', 
and repeat step 1, e will be no longer in col(W^'). This 
is shown as follows. Let e e col(W), then there ex- 
ists some y satisfying Q'y = e and M'y = e. From the 
construction of Q' and the fact that Q is full rank, we 
have yi = Xi for all i ^ 2 and yi = 1 + x%- Conse- 
quently, y T y ^ x T x. This is contradicted by x T x+y T y = 
x T (M T M + Q T Q)x + y T {M' T M' + Q' T Q')y = 0. Finally, 
note that Q 1 is equivalent to Q for the protocol, as the 
outcomes of the first two measurements in the latter case 
can be calculated from the corresponding outcomes in 
the former case. 
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